diff options
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/media/usb/dvb-usb-v2/mxl111sf.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c index e97964ef7f56..2627553f7de1 100644 --- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c +++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c | |||
@@ -23,6 +23,9 @@ | |||
23 | #include "lgdt3305.h" | 23 | #include "lgdt3305.h" |
24 | #include "lg2160.h" | 24 | #include "lg2160.h" |
25 | 25 | ||
26 | /* Max transfer size done by I2C transfer functions */ | ||
27 | #define MAX_XFER_SIZE 64 | ||
28 | |||
26 | int dvb_usb_mxl111sf_debug; | 29 | int dvb_usb_mxl111sf_debug; |
27 | module_param_named(debug, dvb_usb_mxl111sf_debug, int, 0644); | 30 | module_param_named(debug, dvb_usb_mxl111sf_debug, int, 0644); |
28 | MODULE_PARM_DESC(debug, "set debugging level " | 31 | MODULE_PARM_DESC(debug, "set debugging level " |
@@ -57,7 +60,12 @@ int mxl111sf_ctrl_msg(struct dvb_usb_device *d, | |||
57 | { | 60 | { |
58 | int wo = (rbuf == NULL || rlen == 0); /* write-only */ | 61 | int wo = (rbuf == NULL || rlen == 0); /* write-only */ |
59 | int ret; | 62 | int ret; |
60 | u8 sndbuf[1+wlen]; | 63 | u8 sndbuf[MAX_XFER_SIZE]; |
64 | |||
65 | if (1 + wlen > sizeof(sndbuf)) { | ||
66 | pr_warn("%s: len=%d is too big!\n", __func__, wlen); | ||
67 | return -EOPNOTSUPP; | ||
68 | } | ||
61 | 69 | ||
62 | pr_debug("%s(wlen = %d, rlen = %d)\n", __func__, wlen, rlen); | 70 | pr_debug("%s(wlen = %d, rlen = %d)\n", __func__, wlen, rlen); |
63 | 71 | ||